Skip to main content
A jump host (also called a bastion or jump box) is an intermediate server you connect through to reach hosts that aren’t directly accessible from your machine. Jump hosts are common in production environments where target servers live in private networks behind a firewall, and the jump host is the only allowed entry point. Luumen supports single-hop jump hosts: each target host can be configured to connect through one jump host.

​
How it works

When you connect to a host that requires a jump host:
  1. Luumen first authenticates to the jump host using the credential assigned to that jump host.
  2. From the jump host, Luumen establishes a connection to the target host using the credential assigned to the target.
The jump host and target host each use their own credential. They do not share authentication.

​
Mark a host as a jump host

Before you can route traffic through a host, you need to mark it as a jump host:
  1. In the Hosts widget, find the host you want to use as a jump host.
  2. Open its detail page and click Edit.
  3. In the Authentication section, toggle Mark as jump host on.
  4. Confirm the host has a credential assigned. The jump host uses this credential for the first hop.
  5. Click Save.
The host is now available as an option when configuring other hosts.

​
Route a target host through a jump host

For each host that requires a jump host:
  1. In the Hosts widget, find the target host.
  2. Open its detail page and click Edit.
  3. In the Authentication section, set the Jump host dropdown to the host you marked as a jump host.
  4. Confirm the Credential field shows the credential the target host should use after the jump host is reached.
  5. Click Save.
When you click Connect on the target host, Luumen automatically connects through the jump host first.

​
Tips for jump hosts

  • Use a dedicated credential for the jump host. Many teams use a separate user account on the jump host (often with limited shell access) so jump host activity is easy to audit separately from target host activity.
  • Test the jump host independently first. Before assigning a target host to a jump host, test the jump host’s credential to confirm it works on its own. If the jump host can’t connect, every host routed through it will also fail.
  • WinRM hosts cannot be jump hosts. Use SSH for the jump host, even if your target hosts use WinRM.

​
Limitations

  • Single hop only. Luumen does not currently support chained jump hosts (target → jump1 → jump2 → final). Each target host connects through exactly one jump host.

​
Next steps